Skip to content

firewall-integration.md

Latest commit

 

History

History
107 lines (77 loc) · 9.9 KB

firewall-integration.md

File metadata and controls

107 lines (77 loc) · 9.9 KB
title Securing a virtual network in Azure Container Apps
description Firewall settings to secure a virtual network in Azure Container Apps
services container-apps
author craigshoemaker
ms.service azure-container-apps
ms.topic reference
ms.date 04/01/2026
ms.author cshoe

Securing a virtual network in Azure Container Apps with Network Security Groups

Network Security Groups (NSGs) that you need to configure virtual networks closely resemble the settings required by Kubernetes.

You can lock down a network via NSGs with more restrictive rules than the default NSG rules to control all inbound and outbound traffic for the Container Apps environment at the subscription level.

In the workload profiles environment, user-defined routes (UDRs) and securing outbound traffic with a firewall are supported.

Note

For a guide on how to set up UDR with Container Apps to restrict outbound traffic with Azure Firewall, visit the how to for Container Apps and Azure Firewall.

When you use an external workload profiles environment, inbound traffic to Azure Container Apps routes through the public IP that exists in the managed resource group rather than through your subnet. This limitation means that locking down inbound traffic via NSG or firewall on an external workload profiles environment isn't supported. For more information, see Control outbound traffic with user defined routes.

In the legacy Consumption only environment, express routes aren't supported, and custom user-defined routes (UDRs) have limited support. For more information on the level of UDR support available in a Consumption-only environment, see the FAQ.

NSG allow rules

The following tables describe how to configure a collection of NSG allow rules. The specific rules required depend on your environment type.

Inbound

Workload profiles environment

Note

When you use workload profiles, inbound NSG rules only apply to traffic that goes through your virtual network. If you set your container apps to accept traffic from the public internet, incoming traffic goes through the public endpoint instead of the virtual network.

Protocol Source Source ports Destination Destination ports Description
TCP Your client IPs * Your container app's subnet1 80, 31080 Allow your client IPs to access Azure Container Apps when using HTTP. 31080 is the port on which the Container Apps Environment Edge Proxy responds to the HTTP traffic. It's behind the internal load balancer.
TCP Your client IPs * Your container app's subnet1 443, 31443 Allow your client IPs to access Azure Container Apps when using HTTPS. 31443 is the port on which the Container Apps Environment Edge Proxy responds to the HTTPS traffic. It's behind the internal load balancer.
TCP AzureLoadBalancer * Your container app's subnet 30000-327672 Allow Azure Load Balancer to probe backend pools.
TCP Your client IPs * Your container app's subnet Exposed ports and 30000-327672 This rule only applies to TCP apps. This rule isn't required for HTTP apps.

Consumption only environment

Protocol Source Source ports Destination Destination ports Description
TCP Your client IPs * Your container app's subnet1 80, 443 Allow your client IPs to access Azure Container Apps. Use port 80 for HTTP and 443 for HTTPS.
TCP Your client IPs * The staticIP of your container app environment 80, 443 Allow your client IPs to access Azure Container Apps. Use port 80 for HTTP and 443 for HTTPS.
TCP AzureLoadBalancer * Your container app's subnet 30000-327672 Allow Azure Load Balancer to probe backend pools.
TCP Your container app's subnet * Your container app's subnet * Required to allow the container app envoy sidecar to connect to envoy service.

1 You pass this address as a parameter when you create an environment. For example, 10.0.0.0/21.
2 You need the full range when creating your Azure Container Apps as a port within the range is dynamically allocated. Once created, the required ports are two immutable, static values, and you can update your NSG rules.

Outbound

Workload profiles environment

Protocol Source Source ports Destination Destination ports Description
TCP Your container app's subnet * MicrosoftContainerRegistry 443 This service tag represents Microsoft container registry for system containers.
TCP Your container app's subnet * AzureFrontDoor.FirstParty 443 This service tag is a dependency of the MicrosoftContainerRegistry service tag.
Any Your container app's subnet * Your container app's subnet * Allows communication between IPs in your container app's subnet.
TCP Your container app's subnet * AzureActiveDirectory 443 If you're using a managed identity, it's required.
TCP Your container app's subnet * AzureMonitor 443 Only required when using Azure Monitor. Allows outbound calls to Azure Monitor.
TCP and UDP Your container app's subnet * 168.63.129.16 53 Enables the environment to use Azure DNS to resolve the hostname.

Note: DNS communication to Azure DNS isn't subject to NSGs unless targeted using the AzurePlatformDNS service tag. To block DNS traffic, create an outbound rule to deny traffic to the AzurePlatformDNS service tag.
TCP Your container app's subnet1 * Your Container Registry Your container registry's port This rule is required to communicate with your container registry. For example, when using ACR, you need AzureContainerRegistry and AzureActiveDirectory for the destination, and the port is your container registry's port unless using private endpoints.2
TCP Your container app's subnet * Storage.<Region> 443 Only required when using Azure Container Registry to host your images.

Consumption only environment

Note

When you use Consumption only environments, your container app also needs all outbound ports required by Azure Kubernetes Service.

Protocol Source Source ports Destination Destination ports Description
TCP Your container app's subnet * MicrosoftContainerRegistry 443 This service tag represents Microsoft container registry for system containers.
TCP Your container app's subnet * AzureFrontDoor.FirstParty 443 This service tag is a dependency of the MicrosoftContainerRegistry service tag.
UDP Your container app's subnet * AzureCloud.<REGION> 1194 Required for internal AKS secure connection between underlying nodes and control plane. Replace <REGION> with the region where your container app is deployed.
TCP Your container app's subnet * AzureCloud.<REGION> 9000 Required for internal AKS secure connection between underlying nodes and control plane. Replace <REGION> with the region where your container app is deployed.
TCP Your container app's subnet * AzureCloud 443 Allowing all outbound on port 443 provides a way to allow all FQDN based outbound dependencies that don't have a static IP.
TCP Your container app's subnet * EventHub.<REGION> 5671, 5672 Required for internal diagnostics logging in consumption-only environments. Replace <REGION> with the region where your container app is deployed
UDP Your container app's subnet * * 123 NTP server.
Any Your container app's subnet * Your container app's subnet * Allows communication between IPs in your container app's subnet.
TCP and UDP Your container app's subnet * 168.63.129.16 53 Enables the environment to use Azure DNS to resolve the hostname.

Note: DNS communication to Azure DNS isn't subject to NSGs unless targeted using the AzurePlatformDNS service tag. To block DNS traffic, create an outbound rule to deny traffic to the AzurePlatformDNS service tag.
TCP Your container app's subnet1 * Your Container Registry Your container registry's port This rule is required to communicate with your container registry. For example, when using ACR, you need AzureContainerRegistry and AzureActiveDirectory for the destination, and the port is your container registry's port unless using private endpoints.2
TCP Your container app's subnet * Storage.<Region> 443 Only required when using Azure Container Registry to host your images.
TCP Your container app's subnet * AzureMonitor 443 Only required when using Azure Monitor. Allows outbound calls to Azure Monitor.

1 You pass this address as a parameter when you create an environment. For example, 10.0.0.0/21.
2 If you're using Azure Container Registry (ACR) with NSGs configured on your virtual network, create a private endpoint on your ACR to allow Azure Container Apps to pull images through the virtual network. You don't need to add an NSG rule for ACR when configured with private endpoints.

Considerations

  • If you're running HTTP servers, you might need to add ports 80 and 443.
  • Don't explicitly deny the Azure DNS address 168.63.129.16 in the outgoing NSG rules, or your Container Apps environment doesn't function.

Next steps